The question comes up in almost every engagement Chris McGlasson runs as a fractional CIO: what should we actually be spending on IT? The honest answer is that a single percentage of revenue is a poor way to size an IT budget, even though it's the number most owners ask for first. Company age, industry regulation, growth stage, and how much of the business depends on technology to function all matter more than a flat benchmark. What follows is the range Chris McGlasson uses as a starting point for companies in the $10M-$20M revenue band, and the factors that push a specific company above or below it.
The starting benchmark
For a $10M-$20M company with a typical operational mix, IT spend usually falls between 2% and 5% of annual revenue. That's a wide range on purpose. A company running lean on cloud-native tools with minimal on-prem infrastructure lands closer to 2%. A company with more regulatory exposure, custom software, or infrastructure-heavy operations lands closer to 5% or above.
Inside that range, spend typically breaks down across four categories:
- Infrastructure and hosting (cloud services, servers, networking): 25-35%
- Software and licensing (SaaS tools, ERP, line-of-business applications): 25-35%
- Security and compliance (endpoint protection, monitoring, audits, cyber insurance): 15-20%
- Support and staffing (internal IT staff, MSP contracts, or a blend of both): 25-35%
Why the percentage alone is misleading
A $12M company and an $18M company can both sit inside "2-5% of revenue" and still have wildly different problems. Chris McGlasson points to three variables that matter more than the raw percentage:
How much of the business runs through technology. A professional services firm with a handful of core SaaS tools has a very different risk profile than a company running custom manufacturing execution software or a proprietary logistics platform. The more the business depends on technology to operate day to day, the higher the justified spend, regardless of revenue.
Whether the company has been underinvesting. Companies that have run lean on IT for years often need a temporary spike above the benchmark range to catch up on deferred security work, outdated infrastructure, or unsupported software before settling back into a steady state.
Growth trajectory. A company planning to double revenue in three years needs infrastructure that scales ahead of that growth, not behind it. Budgeting to current headcount and current systems load almost always underfunds where the business will be in 18 months.
Where companies at this size overspend
The most common overspend Chris McGlasson sees isn't flashy new tools. It's redundant software licenses across departments that never got consolidated, MSP contracts priced for a company twice the size, and legacy infrastructure kept running because nobody's had the time to migrate off it. A spend audit at this revenue range often finds 10-15% in recoverable waste before a single dollar of new investment gets discussed.
Where companies at this size underspend
Security and strategic planning are the two categories that get cut first when budgets tighten, and they're the two that cause the most expensive problems later. A single ransomware incident or a failed audit typically costs more than several years of the security spend that would have prevented it. Strategic IT planning, the work of actually deciding where technology investment should go next, often has no owner at all in a company this size. That gap is frequently filled by whichever vendor is in the room, which tends to produce a roadmap that serves the vendor more than the business.
How to build a realistic number for your company
Start with the 2-5% range, then adjust based on how dependent the business is on technology, whether there's a backlog of deferred investment, and where the company is headed over the next two to three years. A spend audit against actual invoices, contracts, and license counts, rather than a budget line item, usually reveals the real number is different from what's been assumed.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It's the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.